8

It's possible to hijack the "Select your next badge" call and choose a badge which you've already earned, or one which doesn't even display (e.g. Marshal if you're a ♦ moderator).

Steps to reproduce:

  • Visit your profile page
  • Open the browser console
  • Find your fkey (it's in one of the <script> elements)
  • Insert the fkey and the badge name into the following jQuery snippet, and execute it in the console:

    $.post("/users/activity/next-badge-popup/save",
           "fkey=[YOUR FKEY HERE]&badgeDatabaseName=[BADGE NAME]&isTagBadge=false")
    
  • Profit!

Note that the badge does need to exist on the site; e.g. you can't use this to track the Informed badge on a child meta.

I'd expect some server side check on this as well, though it's obviously not as open to abuse as this issue.

1
  • 5
    And now you fool exactly 1 person... – Luuklag Sep 18 '19 at 11:13

You must log in to answer this question.

Browse other questions tagged .